AMENDMENTS TO THE CLAIMS 

1. (Currently Amended) A method to detect tampering with registry settings in a 
computer, comprising: 

generating by an application program running in the computer a user identity value 
associated with a user identity that is authorized to change a system registry of the 
computer s the user identity value is generated by a one-way function; 

storing the user identity value; 

generating by the application program a registry security value associated with said 
system registry; 

storing the registry security value; and 

authenticating by the application program the system registry after reading the 
system registry. 

2. (Currently Amended) A method as in claim 1, wherein generating a user identity 
value associated with a user identity comprises inserting at least one of the username and password 
in a the one-way function to obtain the user identity value associated with the user identity. 

3. (Previously Presented) A method as in claim 1, wherein generating a registry security 
value associated with a system registry comprises: 

concatenating system registry information; and 

inserting the concatenated system registry information in a one-way function to 
obtain the registry security value. 

4. (Previously Presented) A method as in claim 3, wherein concatenating system 
registry information comprises concatenating at least one of system registry files and system registry 
handle keys. 

5. (Previously Presented) A method as in claim 1 wherein authenticating the system 
registry after reading the system registry further comprises: 

generating a new registry security value; 

comparing the new registry security value with the stored registry security value; and 
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allowing processing to continue if the new registry security value is equal to the 
stored registry security value. 

6. (Previously Presented) A method as in claim 1 further comprising modifying the 
system registry in response to being provided the user identity value and the registry security value. 

Claims 7-9 (Canceled) 

10. (Currently Amended) An article of manufacture comprising: 

a machine-accessible medium including instructions that, when executed by a 
machine, causes the machine to perform operations comprising 

generating a user identity value associated with a user identity that is 
authorized to access a system registry of said machine s the user identity value is 
generated by a one-way function; 

storing the user identity value; 

generating a registry security value associated with the system registry; 
storing the registry security value; 

generating a new user identity value associated with a new user identity 
seeking access to the system registry and comparing the new user identity value to 
the stored user identity value; 

authenticating the system registry after reading the system registry; and 
applying a one-way function to the system registry settings as changed by the 
new user identity to obtain a new registry security value and storing the new registry 
security value for a subsequent authentication of the system registry. 

11. (Currently Amended) An article of manufacture as in claim 10 wherein instructions 
generating a the user identity value associated with a user identity comprises further instructions for 
inserting at least one of the user's username and password in a one-way function to obtain the user 
identity value associated with the user identity. 
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12. (Previously Presented) An article of manufacture as in claim 10 wherein instructions 
for generating a registry security value associated with a system registry comprises further 
instructions for 

concatenating system registry information; and 

inserting the concatenated system registry information in a one-way function to 
obtain the registry security value. 

13. (Previously Presented) An article of manufacture as in claim 12, wherein instructions 
for concatenating system registry information comprises further instructions for concatenating at 
least one of system registry files and system registry handle keys. 

14. (Previously Presented) An article of manufacture as in claim 10 wherein instructions 
for authenticating the system registry after reading the system registry comprises further instructions 
for 

generating a new registry security value; 

comparing the new registry security value with the stored registry security value; and 
allowing processing to continue if the new registry security value is equal to the 
stored registry security value. 

15. (Previously Presented) An article of manufacture as in claim 10 further comprising 
instructions for modifying the system registry in response to being provided the user identity value 
and the registry security value. 

Claims 16-18 (Canceled) 

19. (Currently Amended) An apparatus comprising: 
a bus; 

a data storage device coupled to said bus and that stores a plurality of instructions 
which implement an application program; and 

a processor coupled to said data storage device, said processor operable to receive 
said instructions which, when executed by the processor, cause the processor to 
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generate a user identity value associated with a user identity that is authorized 
to change a system registry of said apparatus t. the user identity value is generated by a 
one-way function: 

store the user identity value; 

obtain a new user identity value: 

compare the new user identify value with the stored user identity value: 
generate a registry security value associated with said system registry; 
store the registry security value; and 

authenticate the system registry after reading the system registry based on the 
stored registry security value. 

20. (Currently Amended) An apparatus as in claim 19, wherein the processor operable 
to receive instructions which, when executed by the processor, cause the processor to generate a 
user identity value associated with a user identity comprises the processor to insert at least one of the 
username and password in a the one way function to obtain the user identity value. 

21. (Previously Presented) An apparatus as in claim 19, wherein the processor operable 
to receive instructions which, when executed by the processor, cause the processor to 

generate a registry security value associated with a system registry comprises the 
processor to concatenate system registry information; and 

insert the concatenated system registry information in a function to obtain the 
registry security value. 

22. (Previously Presented) An apparatus as in claim 21, wherein the processor to 
concatenate system registry information comprises the processor to concatenate at least one of 
system registry files and system registry handle keys. 

23. (Previously Presented) An apparatus as in claim 19 wherein the processor operable 
to receive instructions which, when executed by the processor, cause the processor to authenticate 
the system registry after reading the system registry further comprises the processor to 

generate a new registry security value; 

compare the new registry security value with the stored registry security value; and 
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allow processing to continue if the new registry security value is equal to the stored 
registry security value. 

24. (Previously Presented) An apparatus as in claim 19 wherein the processor operable 
to receive instructions which, when executed by the processor, further causes the processor to 
modify the system registry in response to being provided the user identity value and the registry 
security value. 

25-28 (Canceled) 

29. (Currently Amended) An article of manufacture as in claim 10 further comprising 
instructions for 

allowing processing to continue if the new user identity value is equal to the stored 
user identity value. 

30. (Canceled) 

31. (New) The method of claim 1 further comprising obtaining a user identity 
information in response to detecting a change in registry settings. 
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